NSE7 Advanced VPN and Zero Trust Practice Test 14 — 15 Questions

Question 1

An administrator is configuring a FortiGate as a SAML Identity Provider (IdP) for a third-party service provider. Which of the following is REQUIRED for the FortiGate IdP configuration?

Accepted Answer

A certificate for signing SAML assertions. When FortiGate acts as a SAML IdP, it must sign SAML assertions to prove their authenticity to the SP. A certificate is required for this signing, as the SP will validate the assertion using the IdP's public key. Without a signing certificate, the SAML response cannot be cryptographically verified, breaking the trust model defined in the SAML 2.0 specification.

Answer

The SP's metadata must be imported as a firewall address

Answer

User accounts must be synchronized with an LDAP server

Answer

A pre-shared key between FortiGate and the SP

Question 2

What is the purpose of Dead Peer Detection (DPD) in an IPsec VPN?

Accepted Answer

Detect loss of connectivity to the remote VPN peer. DPD is used to detect if the remote peer is still alive. It sends periodic messages and if no response is received, the tunnel is considered down. Option A is correct.

Answer

Detect if the VPN tunnel is using the correct encryption algorithm

Answer

Detect duplicate IP addresses on the network

Answer

Detect packet loss over the VPN tunnel

Question 3

A FortiGate is configured with ZTNA inline CASB to control access to a SaaS application. The administrator wants to block uploads of files containing credit card numbers. Which ZTNA inline CASB feature should be used?

Accepted Answer

Data leak prevention (DLP) profile. ZTNA inline CASB can apply DLP (Data Loss Prevention) profiles to inspect content. To block uploads with credit card numbers, a DLP profile with a credit card number sensor should be applied to the ZTNA proxy rule. Option B is correct.

Answer

Web filter profile

Answer

Antivirus profile

Answer

Application control profile

Question 4

A FortiGate administrator is troubleshooting a ZTNA problem where users are unable to connect to an internal application via FortiClient. FortiClient reports 'Connection refused'. The FortiGate ZTNA gateway is configured correctly. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Verify that FortiClient can reach the ZTNA gateway's IP and port. Option B is correct because a 'Connection refused' error from FortiClient typically indicates a TCP-level reachability problem to the ZTNA gateway, so verifying that the client can reach the gateway's IP and port (for example, with telnet or Test-NetConnection on the configured access proxy port) confirms whether the failure is at the network path or at the gateway itself. Option C is correct because the ZTNA access proxy rule defines the application mapping (external FQDN/port to the real internal server and port), and an incorrect mapping would cause the gateway to reject or misroute the connection even when the gateway is otherwise configured correctly. Option E is correct because the FortiGate must be able to reach the backend application server; if the server is down, the port is closed, or a firewall/routing issue blocks the FortiGate-to-server path, the access proxy cannot complete the connection and the client sees a refused or failed connection. Option A is not relevant because antivirus update status does not affect ZTNA access proxy connectivity or TCP reachability. Option D is not a diagnostic step; rebooting the FortiClient computer does not isolate the cause and may only mask a transient issue.

Answer

Check the FortiGate's antivirus update status

Answer

Reboot the FortiClient computer

Question 5

A FortiGate is configured as a SAML service provider (SP) for ZTNA. Users authenticate via an external IdP. After authentication, users are not able to access applications even though the ZTNA proxy rule lists them. What should the administrator check FIRST?

Accepted Answer

The ZTNA proxy rule's allowed group does not include the user's group. In FortiGate ZTNA with SAML SSO, after the IdP authenticates the user, FortiGate maps the SAML assertion's group attribute to a local or remote group and then evaluates the ZTNA proxy rule. If the user's group is not listed in the rule's allowed groups, access is denied even though authentication succeeded. Therefore, the first thing to check is whether the ZTNA proxy rule's allowed group includes the group the user was mapped to.

Answer

The FortiClient EMS license is invalid

Answer

The application server is unreachable from FortiGate

Answer

The SAML IdP certificate is expired

Question 6

An administrator wants to enforce that only devices with antivirus software installed and up-to-date can access the corporate network. Which FortiGate feature should be used?

Accepted Answer

ZTNA tags and posture checks. FortiGate uses ZTNA device posture checks via FortiClient EMS to enforce endpoint compliance, such as antivirus status.

Answer

Application control profile

Answer

IPsec VPN with pre-shared key

Answer

Web filtering profile

Question 7

In a hub-and-spoke VPN, spokes cannot communicate with each other directly. The administrator wants to allow direct spoke-to-spoke traffic without routing through the hub. Which technology should be configured?

Accepted Answer

ADVPN with IKEv2. ADVPN (Auto-Discovery VPN) with IKEv2 is Fortinet's proprietary shortcut mechanism that allows spokes to dynamically establish direct tunnels to one another without permanent spoke-to-spoke configuration. The hub acts as a registration point and uses IKEv2 to negotiate shortcut tunnels between spokes on demand, so traffic no longer has to hairpin through the hub. This is the only option that provides dynamic, on-demand direct spoke-to-spoke connectivity.

Answer

Static routes on spokes

Answer

IKEv1 with mode-config

Answer

GRE over IPsec

Question 8

An administrator receives an error when trying to create a ZTNA proxy rule: 'The ZTNA proxy rule requires a valid application mapping.' What does this indicate?

Accepted Answer

The application mapping object is not defined. A ZTNA proxy rule maps an external FQDN/port to an internal application. The error means the application mapping (which defines the internal server) is missing or misconfigured.

Answer

The FortiClient EMS is not reachable

Answer

The SSL certificate is missing

Answer

The firewall policy is not in place

Question 9

A FortiGate has multiple IPsec VPNs to different branch offices. The administrator notices that one VPN tunnel is flapping (going up and down repeatedly). From the CLI, 'diagnose vpn ike gateway list' shows the gateway state as 'up' but then quickly goes to 'down'. What is the MOST likely cause?

Accepted Answer

Dead Peer Detection (DPD) retry interval is too short. A flapping IPsec tunnel where the IKE gateway shows 'up' then quickly 'down' is most commonly caused by Dead Peer Detection (DPD) being too aggressive — if the DPD retry interval or retry count is too short, transient packet loss or latency causes the FortiGate to declare the peer dead and tear down the tunnel, which then renegotiates and flaps.

Answer

The remote gateway's certificate is expired

Answer

The phase2 proposal is mismatched

Answer

The pre-shared key is incorrect

Question 10

Which of the following is a requirement for FortiGate to act as a SAML Identity Provider (IdP) for ZTNA?

Accepted Answer

A configured user database and SAML IdP settings. For a FortiGate to act as a SAML Identity Provider for ZTNA, it must have a configured user database (local or remote) and SAML IdP settings enabled, because SAML requires an identity source and IdP metadata to issue assertions. The FortiGate then generates IdP metadata that the SAML SP (such as FortiClient EMS or a ZTNA client) consumes. Without a user store and IdP configuration, no SAML assertions can be produced.

Answer

A public IP address on the WAN interface

Answer

Integration with FortiClient EMS

Answer

An SSL certificate from a public CA

Question 11

An administrator is configuring FortiClient EMS to enforce compliance for ZTNA. Which TWO settings are required on FortiGate to use compliance-based ZTNA tags?

Accepted Answer

FortiClient EMS is added as a security fabric connector. Option A is correct because FortiGate must add FortiClient EMS as a Security Fabric connector (via Fabric Connectors > Endpoint/EMS) so it can receive the compliance-based ZTNA tags that EMS dynamically assigns to endpoints. Option B is correct because the ZTNA proxy policy must reference those tags as a matching condition (e.g., source 'ZTNA Tags' with the required compliance tag) for the tags to actually enforce access; without the tag condition, compliance data is never evaluated. Option C is not required: SSL deep inspection is a traffic-inspection feature and is unrelated to receiving or matching ZTNA compliance tags. Option D is not required: ZTNA tag-based enforcement relies on EMS-assigned tags, not on a local user database for authentication. Option E is not required: FortiGate acting as a SAML IdP is an authentication scenario and is not needed to consume EMS compliance tags for ZTNA.

Answer

SSL deep inspection is enabled on the firewall policy

Answer

A local user database is configured for authentication

Answer

FortiGate is configured as a SAML IdP

Question 12

A network administrator is troubleshooting an IPsec VPN tunnel between two FortiGates. The tunnel is established but traffic is not passing. The administrator runs 'diagnose vpn ike log' and sees 'no matching policy for this IPsec SA'. What is the most likely cause?

Accepted Answer

There is no firewall policy allowing traffic from the local network to the remote network via the VPN tunnel interface. The log message 'no matching policy for this IPsec SA' on a FortiGate means the IKE/IPsec SA was negotiated successfully but no firewall policy matches the traffic that needs to traverse the tunnel. In FortiOS, a firewall policy with the tunnel interface as the outgoing interface (and matching source/destination) is required for traffic to be encrypted and forwarded. Without it, the tunnel stays up but no data flows.

Answer

The phase2 selectors do not match between peers

Answer

The pre-shared key is mismatched

Answer

The tunnel interface is administratively down

Question 13

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is hosted on a server with IP 10.1.1.100. Which component acts as the intermediary between users and the application in FortiGate ZTNA?

Accepted Answer

ZTNA proxy on FortiGate. FortiGate ZTNA uses a reverse proxy to forward user connections to internal applications. Users connect to the proxy, which verifies identity and posture before proxying traffic to the application server.

Answer

FortiClient EMS

Answer

ZTNA agent on the application server

Answer

ZTNA tags assigned to the application server

Question 14

An administrator runs 'diagnose vpn ike gateway list' and sees that the IKE SA state is 'UP' but the IPsec SA state is 'DOWN'. The remote peer is a FortiGate. What is the most likely cause of this issue?

Accepted Answer

The Phase2 parameters (encryption, authentication, proxy IDs) do not match between the peers. When the IKE SA is UP but the IPsec SA is DOWN, Phase 1 (IKE) has succeeded but Phase 2 (IPsec) negotiation has failed. The most common cause is a mismatch in Phase 2 parameters — encryption/authentication algorithms, PFS settings, or proxy IDs (quick mode selectors) — between the two FortiGates. Since Phase 1 is up, the pre-shared key and basic reachability are already proven correct.

Answer

The pre-shared key is incorrect

Answer

The tunnel interface is down

Answer

The firewall policy on the remote FortiGate is blocking UDP 500

Question 15

An organization uses FortiClient EMS to enforce compliance on endpoints. They want to ensure that only devices with updated antivirus definitions can access the corporate VPN. Which FortiClient configuration should be applied?

Accepted Answer

Create a compliance rule in FortiClient EMS to check antivirus definitions. To enforce compliance based on antivirus definitions, a compliance rule must be created in FortiClient EMS that checks the antivirus definition status. This rule is then used in a ZTNA or VPN policy to allow or deny access. Firewall policies, ZTNA tags, or CASB alone do not check antivirus definitions.

Answer

Use a firewall policy to block traffic from non-compliant devices

Answer

Configure a ZTNA tag that requires updated antivirus

Answer

Enable CASB in the ZTNA proxy